CVE-2026-30351

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A path traversal vulnerability in the UI/static component of leonvanzyl autocoder commit 79d02a allows attackers to read arbitrary files via sending crafted URL path containing traversal sequences.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Apr 27, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-303529.8A remote code execution (RCE) vulnerability in the /devserver/start endpoint of leonvanzyl autocoder commit 79d02a allows attackers to execu CVE-2026-303638.4flipperzero-firmware commit ad2a80 was discovered to contain a stack overflow in the "Main" function.CVE-2026-303647.5CentSDR commit e40795 was discovered to contain a stack overflow in the "Thread1" function.CVE-2026-303685.4A client-side authorization flaw in Lightspeed Systems Classroom v5.1.2.1763770643 allows unauthenticated attackers to impersonate users by CVE-2026-30378.8An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote cod CVE-2026-30387.5The rtsock_msg_buffer() function serializes routing information into a buffer. As a part of this, it copies sockaddr structures into a sock CVE-2026-30397.5BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when rec CVE-2026-30407.2A vulnerability was identified in DrayTek Vigor 300B up to 1.5.1.6. This affects the function cgiGetFile of the file /cgi-bin/mainfunction.c CVE-2026-304029.8An issue in wgcloud v.2.3.7 and before allows a remote attacker to execute arbitrary code via the test connection function CVE-2026-304037.5There is an arbitrary file read vulnerability in the test connection function of backend database management in wgcloud v3.6.3 and before, w CVE-2026-304047.5The backend database management connection test feature in wgcloud v3.6.3 has a server-side request forgery (SSRF) vulnerability. This issue CVE-2026-304057.5An issue in GoBGP gobgpd v.4.2.0 allows a remote attacker to cause a denial of service via the NEXT_HOP path attribute